6 ms·

I have pretty much given up on the prospect of running a full fledged FOSS OS on devices that don’t give access to the bootloader’s root of trust, or give you a

I have pretty much given up on the prospect of running a full fledged FOSS OS on devices that don’t give access to the bootloader’s root of trust, or give you a userland that works with a kernel you can’t control (eg Crouton). It all sounds great until you start trying to do actuall work. As soon as you need anything that’s not provided by the manufacturer software image you start to notice all the foundational things you’re not allowed to do with your system. Need a kernel option or module not provided? Nope, can’t build/sign it. Remember, not all modules are for new hardware (no VMs for you!). Current version of OS? Distro security updates for kernel? Um maybe if they get around to it lol. It kind of reminds me of Doctorow’s thing about war on general purpose computing.* Like how is it in the interest of handset manufacturers to let you have a general purpose computer that could run unsigned (by them) code? To have a real linux distro, you would have to be able to run unsigned privileged code, but that would make it possible to do all sorts of naughty things like unauthorized disk encryption, subverting DRM, mucking around with the radios, etc. You can’t really have have one without the other. * http://opentranscripts.org/transcript/coming-war-general-computation/ http://opentranscripts.org/transcript/coming-war-general-com...

ryukafalz 8y ago
UBports is pretty close: https://ubports.com/ https://ubports.com/ It uses libhybris, so they're limited to the original kernel or something close to it because of proprietary drivers. But it's a community project since Canonical stopped Ubuntu Touch development, and it's had a desktop mode like this for years! The PostmarketOS project is similar, with an explicit goal of mainline support where possible: https://postmarketos.org/ https://postmarketos.org/ But yes, I would be much happier if devices had support in the mainline kernel and could run any distro you wanted right out of the box. (And some devices just straight up lock you out - I try to avoid those whenever possible.)
- chupasaurus 8y ago
  DKMS is out there for a long time, but it might be useless with closed bootloader. You and the author of parent comment should read about Librem 5 (it is supported by UBports as well as GNOME and KDE).
AnIdiotOnTheNet 8y ago
You forget there's also the security twonks in the mix. Those people in favor of forced updates and signing everything too. "Oh my god", they say "what if the user ran something bad!?".
- TazeTSchnitzel 8y ago
  Permission granted to the user is also granted to malware.
  - wtracy 8y ago
    Nobody is arguing against sandboxing. The problem is sandboxing schemes that put the device manufacturers' needs ahead of the device owners' needs.
    - pjmlp 8y ago
      Traditionally when device owners bork the device they show up at the shop and have no idea how it happened, or it was the neighbor's kid. /s
  - esotericn 8y ago
    Okay, so give it an off switch. Gate it behind a long 20-step procedure. Put a video of a guy repeatedly telling the user "hey, hey, this is bad, don't do this unless you're a developer and know why you're doing it, it's a bad!". I mean really you don't even have to go that far. Just give it an off switch.
    - wemdyjreichert 8y ago
      Maybe something like Android's developer mode, where you have to tap something (build version iirc?) In the about phone like 10 times. Won't find it unless you look.
- nl 8y ago
  This is absolutely the way to go for 99% of devices. Yes, you should be able to do some kind of override to say "yes I know what I'm doing and I accept the risks". And... security twonks?
vidarh 8y ago
While I agree with you for a primary device, this is still a major step up to be able to have a nice-ish environment available when you for whatever reason don't have another device with you.
esotericn 8y ago
Indeed. I'm on the lookout for a solid system that can boot a vanilla Linux kernel (something like an x86 laptop or ARM laptop, sub 10 inches preferably) that can make phone calls, receive SMS, and has a built in 4G modem. Does such a thing exist? I'd rather have a crap phone attached to a powerful computer, than a powerful phone that locks itself down so much that it's a crap computer.
- nedp 8y ago
  Seems like what you describe is Purism's upcoming phone, the Librem 5.
  - kossTKR 8y ago
    That project makes me happy. Also just looked at their computers that are beginning to resemble an actual alternative. I remember another "libre" project some years ago which was very expensive and extremely clunky, probably because they wanted to use pre ME intel chips, which it seems they have compromised on now. Anyway it's good to se alternatives catching up. I am so ready to ditch the big-data/fashion companies and i think many people are too, if just the design and eco-system catches up. Personally i think we are less than 10 years from total dystopia if we don't create an "alternative" internet, which is actually just the standard internet without walled gardens, without tracking and with out corporate and state controlled ID systems that will end up imprisoning us all very soon with no escape. I am from Scandinavia and here the state already tracks and cross references all kinds of data on you from health to taxes to criminal record, just as private big-data does in the US. Everyone has a state provisioned login card with serious sec flaws. We are no doubt headed for china-like rating systems and pre-crime drone fuelled nightmares. A large organisation that pushed both free hardware and software for the masses fast is sorely needed to avoid the ultimate tech nightmare that only the coming climate/resource collapse can otherwise save us from. All hail either free private computing or a deus ex machina Carrington Event.
    - meko 8y ago
      Let's be honest, it's either socialism or barbarism.
rauhl 8y ago
> Like how is it in the interest of handset manufacturers to let you have a general purpose computer that could run unsigned (by them) code? Perhaps naïvely, I imagine that selling me hardware is in their interest. Is control of what runs on the hardware they manufacture really worth more than selling that hardware more widely? Granted, there aren’t a whole lot of us who want to run our own OSes, but we do exist. How much money do the manufacturers make by maintaining control? Or do they keep it because of contracts (perhaps like HDMI or other copyright-monopoly-enforcing standards) requiring them to prevent users from owning their hardware?
rudolfwinestock 8y ago
Everyone knows what Microsoft did to the PC market in the 1980s. Everyone knows what the Unix Arts & Crafts movement wants to do to computers today. Open up the bootloader and computers become commodities (modulo some special cases). The makers of those commodities become hostage to whatever platform becomes most popular on those computers. Instead of thinking in terms of "freedom," one should think of this situation in terms of power.
- pjmlp 8y ago
  They liberated it. If it wasn't for IBM's mistakes, all computers would be like Apple and the mobile platforms. Ecosystem silos where everyone would be throwing away their ST, 500, Acorn, Apple, etc every time it was time to upgrade.

ryukafalz 8y ago

UBports is pretty close: https://ubports.com/ https://ubports.com/ It uses libhybris, so they're limited to the original kernel or something close to it because of proprietary drivers. But it's a community project since Canonical stopped Ubuntu Touch development, and it's had a desktop mode like this for years! The PostmarketOS project is similar, with an explicit goal of mainline support where possible: https://postmarketos.org/ https://postmarketos.org/ But yes, I would be much happier if devices had support in the mainline kernel and could run any distro you wanted right out of the box. (And some devices just straight up lock you out - I try to avoid those whenever possible.)

chupasaurus 8y ago
DKMS is out there for a long time, but it might be useless with closed bootloader. You and the author of parent comment should read about Librem 5 (it is supported by UBports as well as GNOME and KDE).

AnIdiotOnTheNet 8y ago

You forget there's also the security twonks in the mix. Those people in favor of forced updates and signing everything too. "Oh my god", they say "what if the user ran something bad!?".

TazeTSchnitzel 8y ago
Permission granted to the user is also granted to malware.
- wtracy 8y ago
  Nobody is arguing against sandboxing. The problem is sandboxing schemes that put the device manufacturers' needs ahead of the device owners' needs.
  - pjmlp 8y ago
    Traditionally when device owners bork the device they show up at the shop and have no idea how it happened, or it was the neighbor's kid. /s
- esotericn 8y ago
  Okay, so give it an off switch. Gate it behind a long 20-step procedure. Put a video of a guy repeatedly telling the user "hey, hey, this is bad, don't do this unless you're a developer and know why you're doing it, it's a bad!". I mean really you don't even have to go that far. Just give it an off switch.
  - wemdyjreichert 8y ago
    Maybe something like Android's developer mode, where you have to tap something (build version iirc?) In the about phone like 10 times. Won't find it unless you look.
nl 8y ago
This is absolutely the way to go for 99% of devices. Yes, you should be able to do some kind of override to say "yes I know what I'm doing and I accept the risks". And... security twonks?

vidarh 8y ago

While I agree with you for a primary device, this is still a major step up to be able to have a nice-ish environment available when you for whatever reason don't have another device with you.

esotericn 8y ago

Indeed. I'm on the lookout for a solid system that can boot a vanilla Linux kernel (something like an x86 laptop or ARM laptop, sub 10 inches preferably) that can make phone calls, receive SMS, and has a built in 4G modem. Does such a thing exist? I'd rather have a crap phone attached to a powerful computer, than a powerful phone that locks itself down so much that it's a crap computer.

nedp 8y ago
Seems like what you describe is Purism's upcoming phone, the Librem 5.
- kossTKR 8y ago
  That project makes me happy. Also just looked at their computers that are beginning to resemble an actual alternative. I remember another "libre" project some years ago which was very expensive and extremely clunky, probably because they wanted to use pre ME intel chips, which it seems they have compromised on now. Anyway it's good to se alternatives catching up. I am so ready to ditch the big-data/fashion companies and i think many people are too, if just the design and eco-system catches up. Personally i think we are less than 10 years from total dystopia if we don't create an "alternative" internet, which is actually just the standard internet without walled gardens, without tracking and with out corporate and state controlled ID systems that will end up imprisoning us all very soon with no escape. I am from Scandinavia and here the state already tracks and cross references all kinds of data on you from health to taxes to criminal record, just as private big-data does in the US. Everyone has a state provisioned login card with serious sec flaws. We are no doubt headed for china-like rating systems and pre-crime drone fuelled nightmares. A large organisation that pushed both free hardware and software for the masses fast is sorely needed to avoid the ultimate tech nightmare that only the coming climate/resource collapse can otherwise save us from. All hail either free private computing or a deus ex machina Carrington Event.
  - meko 8y ago
    Let's be honest, it's either socialism or barbarism.

rauhl 8y ago

> Like how is it in the interest of handset manufacturers to let you have a general purpose computer that could run unsigned (by them) code? Perhaps naïvely, I imagine that selling me hardware is in their interest. Is control of what runs on the hardware they manufacture really worth more than selling that hardware more widely? Granted, there aren’t a whole lot of us who want to run our own OSes, but we do exist. How much money do the manufacturers make by maintaining control? Or do they keep it because of contracts (perhaps like HDMI or other copyright-monopoly-enforcing standards) requiring them to prevent users from owning their hardware?

rudolfwinestock 8y ago

Everyone knows what Microsoft did to the PC market in the 1980s. Everyone knows what the Unix Arts & Crafts movement wants to do to computers today. Open up the bootloader and computers become commodities (modulo some special cases). The makers of those commodities become hostage to whatever platform becomes most popular on those computers. Instead of thinking in terms of "freedom," one should think of this situation in terms of power.

pjmlp 8y ago
They liberated it. If it wasn't for IBM's mistakes, all computers would be like Apple and the mobile platforms. Ecosystem silos where everyone would be throwing away their ST, 500, Acorn, Apple, etc every time it was time to upgrade.